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Exclusion Category 


Summary of activity 


Pro-competition 


In May 2021 the Information Commissioner’s Office (ICO) and the 
Competition and Markets Authority published their blueprint for 
cooperation in digital markets, detailing how they would work 
together to overcome perceived tensions between their objectives, 
with joint work to consider market developments such as the Google 
Privacy Sandbox. 


The ICO developed a Small and Medium sized Enterprise (SME) 
web hub to make it easier for SMEs to act upon data protection 
advice. This complements existing SME helpline, live chat and 
email services. As of the end of September the ICO had responded 
to more than 390,000 organisations; most of which were SMEs. 


It has also proactively provided businesses with information to 
ensure data protection is not an impediment to keeping business 
moving in a data driven world. And it approved its first Certification 
Schemes in areas of age appropriate design, age assurance, and 
asset disposal. The schemes certify that products, services and 
processes businesses provide are compliant with data protection 
legislation. These measures are positive for business. 


Fines and Penalties 


Fines issued to non-public sector organisations for not registering 
with the ICO totalled £98,800. Fines for other data protection 
breaches totalled £25,000. 


Fines for Privacy and Electronic Communications Regulation 
breaches were just over £2.1m. 


Casework 


The ICO handles complaints from individuals under the GDPR and 
the DPA 2018. In the reporting period the ICO received over 37,000 
complaints from the public about data protection issues of which 
over a third relate to businesses; with over 9.500 personal data 
breaches reported. 


Education, 
communications and 
promotion 


Following EU exit the ICO updated all its guidance to reflect that the 
UK has left the EU, and published guidance covering the issues that 
exit raised. 


Following the opening of applications to the ICO regulatory 
sandbox, designed to support organisations using personal data to 
develop innovative products, it published outcomes reports 
highlighting lessons learned and issues for the future. The ICO also 
published its Data Sharing Code - providing practical advice to 
businesses on how to share data responsibly; supporting digital 
innovation across businesses. 


Exclusion Category 


Summary of activity 


Activity related to 
policy development 


The ICO launched consultations on its draft: 

e Journalism code of practice. 

e Regulatory Action Policy 

e New employer hub of guidance products and 

e International data transfer agreement 
In addition the Children’s’ Code came into force in September 2021. 
It ensures that online services likely to be accessed by children 
respect a child’s rights and freedoms when using their personal 
data. A Commissioner’s Opinion on Age Assurance, giving a 
detailed explanation of how the law applies, has also been 
published. These measures are positive for business. 


